GitHub Advisoryadvisory · Go

GHSA-h5rh-w6vm-9ghc Denial of service in Grafana

MEDIUM Published 2022-02-15 Modified 2023-10-02 Official page ↗
Aliases
CVE-2021-27358
Ecosystem
Go
Packages
github.com/grafana/grafana
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:R
Weaknesses
CWE-306, CWE-400
Reviewed
2021-05-14

Affected packages

• Go github.com/grafana/grafana: >= 6.7.3, < 7.4.2 → fixed in 7.4.2

Description

The snapshot feature in Grafana before 7.4.2 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set. Specific Go Packages Affected github.com/grafana/grafana/pkg/middleware

Related

Alias · CVE (1)

  • CVE-2021-27358 The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a… vulnerability

Weakness · CWE (2)

  • CWE-306 Missing Authentication for Critical Functionality weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References